Efficiency of coherent state quantum cryptography in the presence of loss: 

Infiuence of realistic error correction 
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We investigate the performance of a continuous variable (CV) quantum key distribution (QKD) 
scheme in a practical setting. More specifically, we take non-ideal error reconciliation procedure 
into account. The quantum channel connecting the two honest parties is assumed to be lossy but 
noiseless. Secret key rates are given for the case that the measurement outcomes are postselected or a 
reverse reconciliation scheme is applied. The reverse reconciliation scheme loses its initial advantage 
in the practical setting. If one combines postselection with reverse reconciliation however, much of 
this advantage can be recovered. 

PACS numbers: 03.67.Dd, 42.50.-p, 89.70.+C 



I. INTRODUCTION 

Quantum key distribution (QKD) allows two parties, 
the sender Alice and the receiver Bob, to share a key 
which is provably secure against any attack by an eaves- 
dropper (Eve), who may have superior computational 
and technological power. Practical implementations of 
QKD use weak làser pulses, which can be easily con- 
trolled, or parametric down-conversion sources. These 
sources are used together with single-photon detectors to 
realize QKD. For a review see Q. Recently, it has been 
proposed to employ quadrature measurements of optical 
modes as detection devices, thereby introducingwhat is 
known as continuous variable (CV) QKD QSnlES· 
Some of these schemes use non-classical states, while 
others use coherent làser pulses. The aim is to exploit 
the high repetition rates of homodyne detection to over- 
come the limitation in detection rate that is typical for 
single-photon counting at Standard telecom wavelength 
although recently other approaches using frequency con- 
version have been reported 0, 01 • 

In the presence of loss, it seems to be impossible at first 
sight to distill a secret key if the transmission falls below 
50% (3dB loss) (§]. The reasoning is that Eve can replace 
the lossy channel with an ideal one and use a beamsplit- 
ter to tap off Alice's signals to simulate the losses. She 
then obtains the stronger signals whenever the losses are 
bigger than 50%. This apparent advantage of Eve can be 
counteracted as it holds only on average, whether Alice 
and Bob are closely or loosely correlated. Alice and Bob 
can use postselection (PS) to retain only those events 
where they are closely correlated and then have some ad- 
vantage over Eve. The distillation of a secret key rate is 
then possible for any transmittance of the quantum chan- 
nel PJ|. Another way to circumvent the 3dB loss limit 
is to use a suitable one-way information reconciliation 
procedure. If one builds up the key from Bob's measured 
data rather than from Alice's signals, Eve always has less 
information about Bob's measurement result than Alice 
does. This technique is known as reverse reconciliation 
(RR) 0, El an d leads to positive secret key rates for an 



arbitrary loss of the quantum channel 0, 0] . 

There are several ways to extend this scenario to a 
more realistic one. First, one could consider quantum 
channels that are not only lossy, but also impose excess 
Gaussian noise on the quadrature distributions, as is seen 
in experiments. For any excess channel noise S, as seen 
by Bob, there exists a lower limit for the tolerable single- 
photon transmittivity 77, which is given by 



S <2r] 



(1) 



If the losses are higher, one can show that the data can be 
explained as originating from an intercept resend attack. 
In this scenario, no secret key can be distilled [ïflL lïfi|. 
In accordance with this bound, it has been shown that 
the key rate obtained from PS-schemes decreases with 
increasing excess noise (T^ |. 

Here we follow another direction to extend the work of 
[Tol lï^ | and stick to the assumption of a lossy but noise- 
less quantum channel. This scenario can be justified since 
detector noise is the dominant contribution to the total 
noise seen in the experiment 0|. In a trusted device sce- 
nario one can assume that Eve cannot exploit the noise 
of Bob's detectors. The remaining channel noise, which 
can leak information to Eve, is typically less than one 
percent [ïjj] and can thus be neglected in a first approxi- 
mation. Similarly, in Standard QKD with weak coherent 
pulses, the assumption of lossy but noiseless quantum 
channels together with detector dark counts which are 
inaccessible to Eve lead to a very good approximation to 
the rigorous secure key rate. In this scenario we investi- 
gate the implications of the fact that any error correction 
scheme in a real-world application cannot reach the fun- 
damental performance limit given by Shannon [2çj . The 
aim of this article is to compare the performance of re- 
verse reconciliation and postselected schemes where the 
error correcting carries a non-negligible overhead in the 
amount of necessary communication. 

This paper is organized as follows: In the first sec- 
tion, we introduce the investigated protocol and give the 
framework to which our efficiency analysis applies. Next 
we calculate a lower bound on the secret key rate under 
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the assumption that the quantum channel between Alice 
and Bob is lossy but noiseless and Eve is restricted to col- 
lective attacks. It turns out that Eve's information about 
the key can be decomposed into effective binary channels. 
Her information gain per use of such a binary channel is 
computed in section III A for the protocol using direct 
reconciliation (DR) and for the reverse reconciled proto- 
col (RR) in section III B. Afterwards, we calculate the 
total secret key rates for the various protocols and in- 
clude the possibility to use postselection (PS). We then 
proceed by including inefficient but trusted detectors on 
Bob's side in our analysis in section IV. Details about the 
numerical optimization of the secret key rates are given 
in section V. In the last section we conclude and discuss 
our results. 



II. PROTOCOL AND BEAMSPLITTER 
ATTACK 

We consider the situation where Alice sends pure sig- 
nal states \4>i) through the quantum channel to Bob, who 
can verify, for example by performing tomographic com- 
plete measurements, that he indeed always receives pure 
conditional states as expected in the absence of channel 
noise Y$>i) [26]. It follows that the bipartite state of Eve 
and Bob has to be a product state. In the scenario of col- 
lective attacks, the action of the channel can be modeled 
by a unitary coupling to an ancilla system accessible to 
Eve, which is prepared in some Standard state |e ). The 
absence of noise allows to fully characterize Eve's attack. 
We have 

t7|^·)| e °) = |* i )|e í ). 

Since U is unitary, we have 

(<t> i \<l> j ) = (* i \* j )(E i \e j ), 

where {<j)%\<j)j) is given by the state preparation and 
(\E r i|\D r J ·) is fixed by Bob's observation. Therefore the over- 
laps (ei\ej), which contain all of Eve's information about 
the signals, are fixed. 

In our protocol, Alice encodes her bit-value into the 
modulation of two coherent states according to 

|0) = \a) 
II) = |-«>, 

with the coherent amplitude a chosen to be real without 
loss of generality. The states are sent with equal a priori 
probabilities po = pi = |. Bob performs a heterodyne 
measurement on the received states, which is mathemat- 
ically equivalent to a projection onto a coherent state 
|/3) = \/3 x + i(3 y ), From that he is able to conclude that 
he indeed received pure states. That in turn fixes Eve's 
knowledge about the signal states. Furthermore, if Bob 
receives attenuated coherent states \±y/fja), the states 
that Eve holds have to be unitarily equivalent to those 



obtainable by the beamsplitter attack. The input states 
are transformed according to 

\±a) -> \±^a) B ® \±y/ï -m)E (2) 

in this attack. After measuring the signals, Bob assigns 
the bit-value (1), if j3 x is positive (negative) and then 
publicly announces j3 y and the modulus of (3 X of the mea- 
sured j3. As we will see, this announcement will enable 
us to decompose the protocol into effective binary infor- 
mation channels. 



III. LOWER BOUND ON SECRET KEY RATE 

After the exchange of quantum signals between Alice 
and Bob is complete, they proceed with a classical post- 
processing phase in which they correct for errors in their 
bit-strings and cut out Eve's knowledge about the key 
(privacy ampüfication) [2lj . To do so, they need to trans- 
mit information though an authenticated but otherwise 
insecure classical channel. Eve may listen and use any in- 
formation exchanged over the públic channel to optimize 
her attack. 

Alice and Bob may use the classical channel only in 
one direction for error correction. This will result in two 
non-equivalent ways of distilling a secret key from their 
shared classical data. Communication from Alice to Bob 
is common in QKD and we will refer to it as direct recon- 
ciliation (DR), whereas communication in the opposite 
direction is called reverse reconciliation (RR) |2|. The 
secret key is built from the data that the sender in the 
classical communication step holds. In any case, Eve's 
knowledge is summarized in quantum states pi condi- 
tioned on bit-values held by the person who transmits 
the error correction information. Her knowledge about 
the data can be quantified by the Holevo quantity % [12], 
given by 

i 

X = S(p)-J2PiS(Pi) (3) 

i=0 

i 

P = ^PiPi, 

i=0 

which includes Eve being allowed to measure out her an- 
cillas collectively. It turns out j2^| that the secret key rate 
G in this collective attack scenario will then be bounded 
from below by 

G > Ia.b - X ■ (4) 

Note that we have replaced the Holevo quantity between 
Alice and Bob in theorem 1 of 23] by the classical mutual 
Information Ïa-.b, since we are investigating a practical 
QKD scheme with our specified measurement setup. 

Next, we will evaluate Ia-.b and x for different protocols 
and noiseless detectors. 
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A. Mutual information between Alice and Bob 

After the quantum states are distributed and mea- 
sured, Alice and Bob share classical correlated bit- 
strings. The mutual information Ia-.b between the two 
honest parties is determined by the conditional probabil- 
ities that Bob projects onto (3. These are given by 



p(/3 |0) = Ic-((^") 2+ ^) 

7T 



(5) 



ID 



1 



-((&+V^a) 2 +/3= 



Since Eve is only performing an individual coupling of 
the signals to her ancilla systems, Bob's measurement 
outcomes (3 for different signals are independent. The 
mutual information Ia-.b between Alice and Bob cannot 
depend on the value of f3 v , since the agreement on a bit- 
value does not depend on it. Furthermore, the total prob- 
ability that Bob obtains the measurement outcome f3 x is 
given by 



Pi/?*) 



dPy P (/3) 



(6) 



1 / 



7T V / 



From this we see that the two outcomes ±/3 x occur with 
the same probability. It follows that the announcement of 
(3 y and \(3 X \ defines an effective binary information chan- 
nel. The probability e + that Bob assigns the wrong bit- 
value for a given positive value of /3 X > is given by 

_+ pG9-|i) 



p(/3x|0)+p(/3 x |l) 



whereas the corresponding error probability e for neg- 
ative outcomes (3 X < is given by 

P(/3,|0) 



p(/3x|0)+p(/3 x |l) 
From Eqn. © it follows that 

1 



1 _|_ C VÏÏ"I/M ' 



(7) 



so that the effective information channels are symmetric 
in the error rate. Each information channel contributes 
an amount of 1 — H bln (e) to the mutual information, Ia-.b, 
where H bln (e) is the entropy of the binary symmetric 
channel, 

H bin (e) = -e log 2 (e) - (1 - e) log 2 (l - e). 

The probability that an effective information channel is 
being used, is given by 



Pcíft,) = 2p(0 x ). 



(8) 



For the total transmission we find 

Ia-.b = / d/3 x Pc (f3 x ) [l - H bin (e)] . (9) 
Jo 

In order to calculate the secret key rate G according to 
Eqn. (@J, we proceed by bounding Eve's knowledge x 
decomposed in the effective binary information channels. 

B. Direct reconciliation 

Usually in QKD the DR case is considered where the 
secret key is determined by Alice's data. This means that 
Alice sends Bob error correction information in the in- 
formation reconciliation step of the protocol. After Alice 
and Bob have corrected their bit-strings, Eve can make 
use of the information transmitted over the públic chan- 
nel to optimize her measurements on her ancilla systems. 

The quantum states in Eve's hand, conditioned on Al- 
ice's data, are given by l|2| as 



(10) 



These states are pure, so that we have x DR = S(p). 
What remains to be calculated are the eigenvalues of 

p=^(|e )(e Q | + |e 1 )<e 1 |). 

The symmetry allows us to write the states |e;) as 

b) = cd|$ } + ci|$i) (11) 
|e x ) = co|$o}-ci|$i), 

where the |<£>i) are orthonormal states. A short calcula- 
tion shows that p is already diagonal in this basis with 
eigenvalues |c,-| , so that the Holevo quantity is given by 

i 



x M = s(p) = -£N 2 iog 



(12) 



The normalization of p 



M 2 + |ci| 2 = i 



and the overlap 



|c | 2 - |ci| 2 = (e |ei) 



give the expression for the coefficients 
|co| 2 = ~(l + (eo|ei» 
|ci| 2 - \(l-(eo\ei)). 

The overlap of the two coherent states llOj l is 



(13) 



-2(l-r;)a 2 



(14) 
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so that the Holevo quantity can be directly computed. 
Since Eve's quantum states are independent of Bob's 
measurement outcomes (see formula flUO , the value of 
the Holevo quantity for each effective channel, X \Px)i 
does not depend on (3. Therefore, we find that the total 
Holevo quantity for all effective channels becomes 

x ™ = X ™ {Í 3 X ) . (15) 

C. Reverse reconciliation 

In a reverse reconciliation scheme Q, Bob sends error 
correction information to Alice. Therefore Eve is inter- 
ested in obtaining information about Bob's measurement 
results rather than Alice's signals. After Bob's announce- 
ment of \j3 x \ and (3 y , Eve knows which information chan- 
nel is used and, depending on Bob's measurement re- 
sult,that she either holds the state 

P+ = (1- e) |eo)(eo| +e|ei)(ei| 

or 

p_ =e|eo)(e Q | + (l-e)|e 1 )<e 1 | 

in her ancilla system. Here e is the error rate of the effec- 
tive binary information channel (0). In order to obtain 
the correct bit- value, she needs to find out the sign of j3 x . 
Both signs of the measurement outcome occur with the 
same probability p((3 x ) of Eqn. (JJ, so that the proba- 
bility of the effective information channel being used is 
again p c = 2p(/3 x ). The Holevo quantity <EJ in the case 
of reverse reconciliation reads 

x RR (M = s(/j)-p + s(p+)-p_s(/>_) 

- S(p)-~[S( P+ ) + S(p-)}, 

since the probability that Bob gets a positive (negative) 
outcome for a given binary information channel, is simply 
P± = I ( see Eqn. EJ. The entropy of ~p has already been 
calculated and is given by Eqns. ltÏ2ll and ijTÏÏjl . 

Furthermore there exists a unitary operation U (a 
phase-shift of ir) with 

P+ = U P -U\ 

so that S{p+) = S(p-). The basis states of Eqn. 
ltTT|l . which are adapted to the symmetry, can again be 
used to calculate S(p+). In this basis p+ reads 

( |co| 2 (l-2e)cí Co \ 
P+ \{l-2é)c* c x | Cl | 2 )■ 

One can show with the help of Eqn. ltÏ3ll that the eigen- 
values Ai ; 2 of this matrix are of the form 

Ai, 2 -Í(l± A /l + 4e(e-l)(l-|(e |€i)| 2 )), (16) 



so that we have explicitly given 

2 

s (p+) = E -^!°eAi. (17) 

1=1 

With the help of Eqns. jEl , CU , © and {HJ, the 

Holevo quantity per information channel can now be ex- 
plicitly evaluated via 

X RR (f3 x ) = S(p) - S(j>+). (18) 

This quantity varies for the different effective channels. 

D. Postselection 

We have calculated an upper bound x of Eve's infor- 
mation about the key for a given information channel for 
DR and for RR. Also, we have an expression for the total 
mutual information shared between the two parties, Eqn. 
©. The total achievable key rate per signal, as given by 
Eqn. <@J, can then be written as 

G = ^ d/3, Pc (/? x ) [1 - H bin (e) - xiP*)] , (19) 

JO " v ' 

where x(Px) is given by Eqns. li 1211 and II 1511 for DR 
and by formula Ü18II for RR. Here the sum runs over 
all possible information channels. In principle one can 
improve the performance of the protocols by dismissing 
channels where AI ideal {[i x ) < 0, since Eve learns more on 
average about the signals than Bob for those vàlues of 
(5 X . This procedure is called postselection. 

The key rate ifïfljl refers to the case where a perfect er- 
ror correction procedure is used (Shannon limit). Ideally, 
in order to correct a bit-string of large length n, one has 
to exchange asymptotically nH bln (e) bits over the públic 
channel. This information has to be hidden from Eve, 
which can be done in principle by using a one-time-pad 
of exactly the same length. In the end, each use of an 
information channel with error rate e costs H bln (e) secret 
bits to encrypt the necessary error correction information 

na. 

It turns out that all effective information channels yield 
a positive contribution Aï l ^ l (f3 x ) > for the RR proto- 
cols in this idealized setting. This is in agreement with 
the result found in Therefore, it is possible to distill 
a secret key for any transmission of the quantum chan- 
nel, and the performance of the RR protocol cannot be 
improved further by using postselection. 

Practical codes that work exactly at the Shannon limit 
are not known. Effkient codes work close to that limit, 
so in practice one has to reveal more information to cor- 
rect one bit, i.e. /(e)H bln (e), where /(e) represents the 
efficiency of the used protocol (f(e) > 1). The coefficient 
/(e), which determines the overhead one has to pay for 
realistic error correction, depends in all practical schemes 
on the error rate e. To see how the key rate G scales when 
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an error correction scheme with efficiency /(e) is used, we 
can rewrite formula (TL9)l as 



G = / d0 x p c (0 x ) 
lo 



l-f(e)K hin (e)- X (í3 x ) 



(20) 



The quantity x(Px) ls again given by Eqns. ltÏ2ll and l(Ï5|l 
in the DR and by I|18J1 in the RR case respectively. Post- 
selection can again be applied once Alice and Bob know 
the efficiency /(e) of their error correction procedure ap- 
proximately. Thus postselection now is relevant not only 
for DR, but also for the RR scenario. 



e 


/(e) 


0.01 


1.16 


0.05 


1.16 


0.1 


1.22 


0.15 


1.32 



TABLE I: Efficiency of Cascade [2J 
the error rate e 



for diíïerent vàlues of 



V. NUMÈRIC AL PROCEDURE FOR 
CALCULATING THE KEY RATE 



IV. DETECTOR NOISE 

By now we have obtained secret key rates while ne- 
glecting any kind of noise. While experiments show that 
the channel noise is low, the noise of the detector is not 
negligible, but of the order of 0.1 shot noise units. In a 
trusted device scenario we assume that Eve cannot ma- 
nipulate the detector noise to leak information about the 
signals to her. On the other hand, this noise increases 
the cost of error correction. It is interesting to see how 
this affects the key rate. We define the excess noise S 
imposed by the detector by 



1. 



(21) 



where A^ hs f3 x is the observed variance of /3 X seen in ex- 
periments and Agj^jSz is the shot noise limited variance 
of p x . The probability that Bob obtains the measurement 
outcome [3 X is then given by 

^ ct (p x ) = 



P 



(22) 



2^( 1 + < 5 ) 

including detector noise. This leads to a modified error 
rate of the efficient binary channels, given by 

1 



„Dct 



1 



(23) 



The secret key rate can then be calculated as described 
in the previous sections for any value of the excess noise 
S, one has only to use the modified expressions for Bob's 
probability distribution 112211 and for the error rate 12-ill 
instead of Eqns. © and (0 in all preceding formulas. 
This will lead to a decrease of the mutual information 
Iab between Alice and Bob with growing excess noise 5 
to account for the higher cost of error correction. While 
the cost of privacy amplification \ DR per use of an ef- 
fective binary information channel in the DR protocol 
lllót is unaffected by the detector noise, the correspond- 
ing quantity x CHt for the RR protocol decreases with 
increasing detector noise. This effect originates from the 
fact that Eve is more uncertain about Bob's measurement 
outcomes if he uses inefficient detectors. 



Now we have everything at hand to compute G. For 
this, we resort to numerical calculations. We assume that 
our error correction can work as efficiently as the bidi- 
rectional protocol Cascade (Ü)]. To be precise, we use a 
linear fit of the efficiency of Cascade (see tableG} for the 
function /(e) in our numerical optimization. Formally, 
one-way communication would be needed to justify the 
use of the Devetak-Winter bound However in the 
worst case scenario when using two-way communication, 
Eve learns all positions where Bob assigned the wrong 
bit-value. Therefore the Devetak-Winter bound could 
still be applied if one additionally announces Bob's error 
positions. But since Eve's knowledge about the key 11211 
in the DR setting does not depend on Bob's measure- 
ment outcome f3 x , the resulting key rate would remain 
unchanged. Therefore two-way error correction methods 
can be applied directly in connection with DR methods 
in the lossy channel. In RR, however, strict one-way 
communication is essential. Since we are here interested 
in efficiency considerations only, we ignore the problem 
of finding a practical one-way protocol that can be as 
efficient as Cascade and simply assume we have such a 
protocol. Still, we have to keep in mind that the rate 
for DR can be implemented directly with known proto- 
cols, whereas the RR rate requires the usage of efficient 
one-way error correction protocols. 

For given transmission r\ of the quantum channel and 
excess noise 5 imposed by Bob's detector we 

• choose an amplitude a of Alice 's coherent signal 
states, 

• calculate AI prac {(i x ) for all information channels (3 X 
taking realistic error correction into account, 

• discard all channels where AI prac (J3 X ) < in post- 
selection protocols, 

• integrate over the remaining channels to obtain the 
key rate G(rj, a), 

• start over such as to optimize over a for a given 
transmission r\. 
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FIG. 1: Comparison of the secret key rate G versus trans- 
mission r\ for ideal (sòlid lines) and realistic error correction 
(dashed lines) for a postselected DR protocol and a RR pro- 
tocol. The dotted line represents a postselected RR protocol 
with realistic error correction. 



VI. NUMERICAL EVALUATION AND 
DISCUSSION 

Let us first neglect any detector noise on Bob's side. 
Fig. summarizes our numerical results for the RR pro- 
tocol and for the postselected DR scheme for the case 
that Bob's detectors are noiseless. If ideal error correc- 
tion is assumed, the RR scheme clearly performs better 
than the postselected DR scheme. In this setting, an 
additional postselection step in the RR protocol cannot 
improve the performance, since all information channels 
yield a positive advantage Al^g" (/?.,;) > for Alice and 
Bob. The key rate for a non-postselected DR scheme is 
not shown, since it would be limited by 50% losses and 
is therefore not of interest for practical QKD. 

The key rate decreases significantly in the non- 
postselected RR protocols if one does not assume an ideal 
error correction. This is however not a problem of RR 
itself, but due to the fact that in the simple approach all 
bits have to be corrected. Since one has to shrink the 
key by /(e)H bln (e) bits of information to correct a bit 
coming from a channel with error rate e in a realistic sce- 
nario, it follows that the usage of information channels 
with high error rate e effectively shrinks the key. Using 
all information channels would completely negate the ad- 
vantage of non-postselected RR versus postselected DR 
in a realistic scenario. As a remedy, we propose to intro- 
duce postselection of effective binary channels in the RR 
protocol as well. This combination of the RR idea and 
postselection can help to give good performance with re- 
alistic protocols. The dotted curve in Fig. represents 



our numerical results for a postselected RR protocol. 

Our results for imperfect detectors are summarized in 
Fig. Since it is necessary to postselect the data in 




transmission r\ 



FIG. 2: Influence of detector noise. Secret key rates G ver- 
sus transmission r\ for ideal (sòlid lines) and realistic error 
correction (dashed lines) for a postselected DR protocol and 
a postselected RR protocol are shown. The dashed lines in- 
clude an excess noise of S = 0.1. 



the RR case even in absence of detector noise, we omit 
the curves for the non-postselected RR protocol. We 
find that all investigated postselected protocols are ro- 
bust against typical vàlues of the detector excess noise 
S. The dashed lines in Fig. [2 include a detector noise 
of S = 0.1 and do not differ significantly from the cor- 
responding curves in Fig. Q]which include an inefncient 
error correction protocol but neglect noisy detectors. For 
the RR protocol, the effect of detector noise is almost 
negligible. As mentioned before, this is due to the fact 
that the cost of privacy amplification x RR decreases in 
the RR scenario. This can partially compensate for the 
higher cost of error correction. 

In conclusion we find that it is important to take the 
influence of inefncient error correction into account in 
evaluating QKD protocols. We propose to combine post- 
selection with reverse reconciliation to deal with losses 
in realistic continuous variable QKD. It should be em- 
phasized that efficient one-way error reconciliation pro- 
cedures are essential to make this approach work. As a 
fall-back position, we can use the DR scheme with PS for 
which protocols are available already today. 

We thank F. Grosshans for helpful discussions. This 
work has been supported by the network of competence 
QIP of the state of Bavaria (A8), the EU-IST network 
SECOQC and the German Research Council (DFG) un- 
der the Emmy-Noether program. 
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